Everything an AI agent can do with the Guru API.

A reference guide for building AI agents: every method, how to authenticate, and the permissions each one needs.

Endpoints32
API versionv1
Last updated23 June 2026
Orientation

How the Guru API works.

The Guru API is how an app or AI agent works with a Guru workspace: searching cards of verified knowledge, creating and updating a card, verifying a card so the team can trust it, and organizing cards into folders and collections. Access is granted through a token sent with HTTP Basic auth, where a user token carries read and write across the collections that person can reach and a collection token is read-only and scoped to a single collection. Guru can also push events to a registered URL when something happens, like a card being created or verified.

32Endpoints
9Capability groups
18Read
14Write
2Permissions
Authentication
Guru authenticates every call with HTTP Basic auth over the base URL https://api.getguru.com/api/v1/. The username and password are either a user's email and a user token, or a collection id and a collection token. There is no separate API key header; the token is the Basic-auth password. OAuth 2.0 is also available, and is the route Guru's MCP server and connected clients use.
Permissions
Access depends on the token type, not a per-endpoint scope list. A user token carries read and write and can call GET, POST, PUT, and DELETE, and how far it reaches follows that user's role, so a team admin token sees more than an author token in restricted collections. A collection token is read-only, can call GET methods only, and returns results from just the one collection it is tied to. Member and group changes need an admin-level user token.
Versioning
Guru runs a single, continuously updated API with no dated versions to pin. Every path sits under the v1 prefix, and changes ship to that one live API. New endpoints are announced through the Guru Developer Network rather than a new version string.
Data model
Guru is built around the card, a single unit of verified knowledge. Cards live in collections, and a token's reach is defined by which collections it can see. Folders, which replaced the older boards, organize cards within a collection, and a card can carry comments, tags, verifiers, and a verification state. People belong to a team and to groups, and groups are granted access to collections.
Connect & authenticate

Connection & authentication methods.

How an app or AI agent connects to Guru determines what it can reach. There is a route for making calls, a route for receiving events, and a hosted server that exposes Guru's knowledge to agents, and each is governed by the token behind it and the access that token carries.

Ways to connect

REST API

The REST API answers at https://api.getguru.com/api/v1/, takes and returns JSON, and pages long lists through a Link header. A call authenticates with HTTP Basic auth, sending a user email and token, or a collection id and token, as the username and password.

Best forConnecting an app or AI agent to Guru.
Governed byThe token and the access it carries.
Docs ↗

Webhooks

Guru posts events to a URL registered for the chosen event types, so an app learns about activity like a card being created, updated, or verified without polling. A single user can create up to 25 webhook subscriptions, and what a subscription can see depends on the creator's Guru role.

Best forReceiving Guru events at an app or AI agent.
Governed byThe role of the user who created the subscription.
Docs ↗

MCP server (Model Context Protocol)

Guru's first-party MCP server at https://mcp.api.getguru.com/mcp exposes Guru's knowledge to AI clients like Claude, ChatGPT, and Cursor through the Model Context Protocol. It lets an agent search the knowledge base, ask for verified and cited answers, and create or update cards, and it authenticates with OAuth or an API token.

Best forConnecting an AI agent to Guru through MCP.
Governed byThe OAuth grant or the API token and the access it carries.
Docs ↗
Authentication

User (API) token

A user token authenticates as a person and carries read and write access, so it can call GET, POST, PUT, and DELETE. What it reaches depends on that person's authorization: a team admin token sees more than an author token in restricted collections. It is sent with the user's email through HTTP Basic auth.

TokenUser API token (email as username)
Best forRead and write access across the collections a user can reach.
Docs ↗

Collection token

A collection token is authorized at the level of a single collection and is read-only, so it can call GET methods only and returns results from just that one collection. It is sent with the collection id as the username through HTTP Basic auth.

TokenCollection token (collection id as username)
Best forRead-only access scoped to one collection.
Docs ↗

OAuth 2.0

OAuth 2.0 lets an app or AI client connect on a user's behalf without holding a raw token, and it is the route Guru's MCP server and connected clients use. The resulting access represents the authorizing user.

TokenOAuth access token
Best forConnected clients and AI agents that authenticate per user.
Docs ↗
Capability map

What an AI agent can do in Guru.

The Guru API is split into areas an agent can act on, like cards, collections, folders, groups, and people. Each area has its own methods, and a write here changes the knowledge a team relies on.

Cards

8 endpoints

Read, create, update, and delete cards, verify and unverify them, and read the folders and favorite lists a card sits in.

Writes here change real card content the team trusts.
View endpoints

Card comments

3 endpoints

List, create, and delete the comments on a card.

Writes here add or remove comments other people see.
View endpoints

Collections

2 endpoints

List the collections a token can reach and read a single collection by id.

These are read methods; they change nothing.
View endpoints

Folders

5 endpoints

List folders, read a folder's items, create and update folders, and delete a folder. Folders replaced the older boards.

Writes here move and reorganize content for everyone.
View endpoints

Search

2 endpoints

Search for cards across a workspace with a query string, and run a richer search that returns cited sources.

These are read methods; they return only what the token can see.
View endpoints

Groups

3 endpoints

List user groups, read a group's members and the collections it can reach, and add or remove a member.

Writes here change who belongs to a group and what they can see.
View endpoints

People & members

5 endpoints

List team members, read and update a person's profile, invite a user to the team, and read the authenticated identity.

Writes here invite people and change profiles.
View endpoints

Tags

3 endpoints

List tag categories, read a tag, and create a tag.

Writes here add tags that label cards across the workspace.
View endpoints

Analytics

1 endpoint

List the activity events recorded for a team.

This is a read method; it returns activity history.
View endpoints
Endpoint reference

Every Guru API method.

Filter by method, access, or permission, or search any path. Select a row for version detail, rate limits, the related webhook event, and the source.

MethodEndpointWhat it doesAccessPermissionVersion

Cards

Read, create, update, and delete cards, verify and unverify them, and read the folders and favorite lists a card sits in.8

Reachable with a read-only collection token if the card is in that collection, or a user token at the caller's authorization level.

Acts oncard
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Writes need a user token with read/write; a collection token is read-only and cannot create cards.

Acts oncard
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventcard-created
Rate limitStandard limits apply

Needs a user token with read/write.

Acts oncard
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventcard-updated
Rate limitStandard limits apply

Irreversible; needs a user token with read/write.

Acts oncard
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventcard-deleted
Rate limitStandard limits apply

Verification is Guru's trust signal; needs a user token with read/write.

Acts oncard
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventcard-verified
Rate limitStandard limits apply

Needs a user token with read/write.

Acts oncard
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

A read method; reachable with a read-only collection token for cards in that collection.

Acts oncard
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

A read method. Guru models a favorite as adding a card to a favorite list rather than a single toggle.

Acts oncard
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Card comments

List, create, and delete the comments on a card.3

A read method; reachable with a read-only collection token for cards in that collection.

Acts oncomment
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs a user token with read/write.

Acts oncomment
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventcard-comment-created
Rate limitStandard limits apply

Needs a user token with read/write.

Acts oncomment
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventcard-comment-deleted
Rate limitStandard limits apply

Collections

List the collections a token can reach and read a single collection by id.2

A read method. A collection token returns only its own collection here; a user token returns all collections the caller can see.

Acts oncollection
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

A read method; reachable with a read-only collection token for its own collection.

Acts oncollection
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Folders

List folders, read a folder's items, create and update folders, and delete a folder. Folders replaced the older boards.5

A read method; reachable with a read-only collection token within that collection.

Acts onfolder
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

A read method; reachable with a read-only collection token within that collection.

Acts onfolder
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

The body sets an actionType, such as add, and where to place the item. Needs a user token with read/write.

Acts onfolder
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventcard-added-to-board
Rate limitStandard limits apply

Needs a user token with read/write.

Acts onfolder
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventboard-updated
Rate limitStandard limits apply

Needs a user token with read/write.

Acts onfolder
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventboard-deleted
Rate limitStandard limits apply
Search for cards across a workspace with a query string, and run a richer search that returns cited sources.2

Results are scoped to what the token can see; a collection token returns only matches in its own collection. Pages through the Link header.

Acts onsearch result
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit50 cards per page

A read method; results are limited to what the token can see.

Acts onsearch result
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Groups

List user groups, read a group's members and the collections it can reach, and add or remove a member.3

A read method; needs a user token with the caller's authorization to see groups.

Acts ongroup
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

A read method; returns the people in the group.

Acts ongroup
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Changes who can see the collections the group reaches. Needs a user token with admin authorization.

Acts ongroup
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

People & members

List team members, read and update a person's profile, invite a user to the team, and read the authenticated identity.5

A read method; returns each person's name, email, role, and status.

Acts onmember
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Must be called as a team admin. The body takes a list of emails and a role, such as MEMBER or AUTHOR; invited people stay PENDING until they accept.

Acts onmember
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

A read method; returns a single person's profile fields.

Acts onperson
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs a user token with admin authorization to change another person's profile.

Acts onperson
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Reachable with any valid token; the tokenType field returns API, SESSION, COLLECTION, OTHER, or UNKNOWN.

Acts onidentity
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Tags

List tag categories, read a tag, and create a tag.3

A read method; a tag belongs to a category, and a category belongs to a team.

Acts ontag category
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

A read method; returns one tag's detail.

Acts ontag
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs a user token with read/write.

Acts ontag
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Analytics

List the activity events recorded for a team.1

A read method; pages through the Link header when more than 500 events match.

Acts onevent
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit500 events per page
No endpoints match those filters.
Webhooks

Webhook events.

Guru can notify an app or AI agent when something happens in a workspace, like a card being created, updated, or verified, instead of the app repeatedly asking. Guru posts the event to a URL registered for the chosen events.

EventWhat it signalsTriggered by
card-createdFires when a card is created./v1/cards/extended
card-updatedFires when a card's content or metadata is updated./v1/cards/{cardId}/extended
card-deletedFires when a card is deleted./v1/cards/{cardId}
card-verifiedFires when a card is marked verified./v1/cards/{cardId}/verify
card-comment-createdFires when a comment is created on a card./v1/cards/{cardId}/comments
card-comment-deletedFires when a comment is deleted from a card./v1/cards/{cardId}/comments/{commentId}
card-added-to-boardFires when a card is added to a folder. The event keeps the older board name from before folders replaced boards./v1/folders/{parentId}/action
board-updatedFires when a folder is updated. The event keeps the older board name./v1/folders/{folderId}
board-deletedFires when a folder is deleted. The event keeps the older board name./v1/folders/{folderId}
No events match that search.
Rate limits & pagination

Rate limits, pagination & request size.

Guru limits how fast an app or AI agent can call, through a per-account request rate that returns a back-off response when exceeded, and it pages long result sets through a link to the next page.

Request rate

Guru enforces a request rate per account and returns HTTP 429 Too Many Requests when it is exceeded; the documented guidance is to back off and retry after a short wait rather than a published number of requests per minute. The reference pages do not state a per-method cost, so an integration should treat the rate as a shared account budget and smooth out bursts.

Pagination

Long result sets are paged with a Link header. When more results remain, the response carries a Link header with rel="next-page" holding the URL of the next page, and an integration follows that link until no Link header is returned rather than building the URL by hand. Page size depends on the endpoint, for example search returns at most 50 cards per page and analytics at most 500 events per page.

Request size

Responses are JSON. Search returns at most 50 cards per page and the analytics events endpoint at most 500 events per page; other list endpoints set their own page sizes, which the reference notes can change over time.

Errors

Status codes & error handling.

The status codes an agent should handle, and what to do about each.

StatusCodeMeaningWhat to do
401UnauthorizedAuthentication is missing or invalid, for example a wrong token, or the wrong username for the token type.Send valid HTTP Basic credentials: the user email with a user token, or the collection id with a collection token.
403ForbiddenThe token is valid but does not have the access the call needs, for example a read-only collection token attempting a write, or a non-admin token inviting a user.Use a user token at the right authorization level, or an admin token for member and group changes.
404Not FoundThe path is wrong, or the resource is not visible to the token, for example a card outside the collection a collection token is scoped to.Check the path and confirm the token can reach the resource.
429Too Many RequestsThe account's request rate was exceeded.Back off for a short period, then retry. Spread out bursts of calls.
Versioning & freshness

Version history.

Guru runs a single, continuously updated version of its API. There is no dated version to pin, and every path sits under the v1 prefix.

Version history

What changed, and when

Latest versionv1
v1Current version
Single, continuously updated API

Guru exposes one REST API under the v1 path prefix, with no dated versions to pin and no version header to send. Changes ship to the same live API, and new endpoints are announced through the Guru Developer Network. Notable additions include the move from boards to folders and the first-party MCP server.

What changed
  • Boards replaced by folders; the older /boards path removed in favor of /v1/folders
  • First-party MCP server published at https://mcp.api.getguru.com/mcp for AI clients
  • OAuth 2.0 clients and impersonation tokens documented for connected apps

There is no version header to set; an integration calls the current API directly.

Guru Developer Network ↗
Questions

Guru API, answered.

What's the difference between a user token and a collection token?+
A user token authenticates as a person, carries read and write, and can call GET, POST, PUT, and DELETE across the collections that person can reach, with a team admin token reaching more than an author token. A collection token is authorized at one collection, is read-only, can call GET methods only, and returns results from just that collection. Using a collection token first requires the collection id, which a user token can fetch from the collections list.
How does authentication work?+
Guru uses HTTP Basic auth. For a user token, the username is the user's email and the password is the token; for a collection token, the username is the collection id and the password is the token. The same credentials are sent on every call to https://api.getguru.com/api/v1/. OAuth 2.0 is the alternative, used by connected clients and the MCP server.
What happened to boards?+
Boards were replaced by folders in the current API, and the older /boards path was removed. Folders are organized at /v1/folders, where a folder lists its items and can contain both cards and other folders. Some webhook event names still carry the older board wording, such as card-added-to-board, board-updated, and board-deleted, even though they fire on folder activity.
How do I search for cards?+
The search endpoint takes a query string and filters expressed in Guru Query Language, and returns at most 50 cards per page. Results are scoped to what the token can see, so a collection token only returns matches in its own collection. When more than 50 cards match, a link to the next page comes back in the Link header.
Does Guru have an official MCP server?+
Yes. Guru's first-party MCP server at https://mcp.api.getguru.com/mcp exposes its knowledge to AI clients such as Claude, ChatGPT, and Cursor through the Model Context Protocol. It lets an agent search the knowledge base, ask for verified and cited answers, and create or update cards, and it authenticates with OAuth or an API token.
How do I receive events instead of polling?+
Webhooks deliver events without polling. A subscription registers a URL and a set of event types, such as card-created, card-updated, card-verified, or card-comment-created, and Guru posts the event when it fires. A single user can create up to 25 subscriptions, and what a subscription can see depends on that user's Guru role.
What are the rate limits?+
Guru enforces a request rate per account and returns HTTP 429 Too Many Requests when it is exceeded. The guidance is to back off for a short period and retry, rather than a published per-minute number, so an integration should smooth out bursts and treat the budget as shared across the account.
Related

More productivity API guides for agents

What is Bollard AI?

Control what every AI agent can do in Guru.

Bollard AI sits between a team's AI agents and Guru. Grant each agent exactly the access it needs, read or write, resource by resource, and every call is checked and logged.

  • Set read, write, or full access per agent, never a shared Guru token.
  • Denied by default, so an agent reaches only what has been explicitly allowed.
  • Every call recorded in plain English: who, what, where, and the decision.
Guru
Knowledge Agent
Search cards ActionOffReadFull use
Create and update cards ActionOffReadFull use
Invite team members ActionOffReadFull use
Per-agent access, set in Bollard AI, not in Guru